Check Point Research

Force in Play

Published technical analysis of the bypass

Any password longer than 256 characters will log an attacker into an account set up for SSH-key login only, on Alpine Linux and other systems that pair the musl C library with OpenSSH. The flaw, nicknamed *sshole, has worked that way since 2016.

Updated 2 hours ago